Ecommerce Laws: A Guide for Online Stores (2026)

This post is for information only. You are responsible for reviewing and using this information appropriately. This content doesn’t contain and isn’t meant to provide legal, tax, or business advice. Requirements are updated frequently and you should make sure to do your own research and reach out to professional legal, tax, and business advisers, as needed. To sell products using the Shopify platform, you must comply with the laws of the jurisdiction of your business and your customers, the Shopify Terms of Service, the Shopify Acceptable Use Policy, and any other applicable policies.

Ecommerce laws govern how businesses sell products and services online. They cover four areas, including business structure and licensing, consumer protection and transparency, data privacy, and tax compliance.

The rules vary by jurisdiction, and selling across state or national borders can introduce additional obligations. The products you sell also affect which rules apply, including the licenses your business needs.

This guide explains the legal requirements to check before launching an online store and the responsibilities you’ll need to manage as your business grows.

Ecommerce laws: legal requirements for online stores

Compliance begins on day one of selling online, with some obligations arising before your first sale. Check which registrations and licenses your business needs during setup, and obtain any necessary approvals before you begin trading.

Your storefront also needs to comply with applicable consumer protection laws from launch. For example, US truth-in-advertising rules apply to online product descriptions and promotions. Check that your claims are accurate and that you have evidence for them before publishing.

Protecting your customers: consumer protection laws and regulations

Publish store policies that explain how you handle customer data and purchases. Your return policy needs clear eligibility rules and refund instructions. Your shipping policy should include realistic time frames, while your terms of service set out the conditions that govern purchases. The disclosures required by law vary by jurisdiction.

Shopify lets you add and manage store policies in your admin and links them in the checkout footer. Add links to your storefront footer so shoppers can read them before checkout. Review generated policies against your business practices and applicable laws.

Keep personal data private and secure

Check what personal information your store and apps collect, who receives it, and which privacy laws apply. Key areas to review include:

• Website tracking
• GDPR
• Email marketing
• Privacy policies

Website tracking

The California Consumer Privacy Act (CCPA) gives California residents rights over their personal information, including deletion and opting out of its sale or sharing.

Covered businesses have to explain their data practices and honor applicable requests. Check the law’s coverage thresholds and exemptions before determining your obligations.

GDPR

The EU’s General Data Protection Regulation applies to personal data processing connected with an EU establishment. It also covers businesses outside the EU when they offer goods or services to people in the EU or monitor their behavior there. A small business can fall within its scope.

Email marketing

The Federal Trade Commission (FTC) enforces the CAN-SPAM Act, which requires accurate sender information and subject lines. Identify commercial messages appropriately, include a valid postal address, and provide a clear unsubscribe option.

Honor opt-out requests within 10 business days and monitor vendors sending emails on your behalf. Shopify can collect email marketing consent at checkout and customer account sign-in.

Privacy policies

No federal law requires every US online business to publish a privacy policy, but state laws create that obligation for many stores. California’s CalOPPA requires commercial websites collecting personally identifiable information from California consumers to post one.

Virginia’s Consumer Data Protection Act requires covered businesses to provide a privacy notice. Check the laws wherever your customers live, including state privacy laws that took effect in 2026.

Shopify’s free privacy policy generator creates a template you can customize for your business. Within Shopify, customer privacy settings let you manage an automated privacy policy, cookie banner, and data-sharing opt-out page. Review the policy for accuracy and check that third-party tracking tools honor customers’ consent choices.

Additional rules apply to certain types of data and audiences:

• Children’s data. COPPA covers websites and online services directed to children under 13, plus general-audience services that knowingly collect their personal information. Covered operators generally need verifiable parental consent before collection, subject to limited exceptions.
• Health information. The Health Breach Notification Rule sets breach-reporting duties for certain providers of personal health records and related services outside HIPAA, including some health apps. Required notifications can extend to affected customers, the FTC, and the media.

Securely handle customer financial data

US organizations reported a record 3,322 data compromises in 2025, according to the Identity Theft Resource Center’s annual report.

Review the security obligations that apply to your payment setup regarding payment security, E-sign Act compliance, and identity theft protection.

Payment security

PCI DSS is an industry security standard for protecting cardholder data. Merchants accepting card payments have obligations even when a third party handles all processing.

Outsourcing reduces the requirements that apply directly to your systems, but you must check the provider’s compliance and confirm any validation requirements with your acquiring bank or payment brand. Shopify is Level 1 PCI DSS compliant, with certification covering its hosted stores, shopping carts, and web hosting.

E-Sign Act compliance

The E-Sign Act recognizes electronic records and signatures. When delivering consumer disclosures electronically that the law requires in writing, follow the applicable consent requirements. These cover information about accessing electronic records and obtaining paper copies.

Identity theft prevention

The Red Flags Rule requires financial institutions and certain creditors with covered accounts to maintain a written identity theft prevention program. Accepting credit cards alone is insufficient to bring a merchant within its scope.

Provide quality products and service

Check your product claims and sales practices against these consumer protection rules:

• False advertising protections
• Review transparency
• Order fulfillment regulations
• Endorsement and affiliate disclosure
• All-in pricing

False advertising protections

The FTC Act prohibits unfair or deceptive business practices. Your advertising claims must be truthful and backed by evidence. Check product descriptions and promotions for claims you can substantiate.

Review transparency

The Consumer Review Fairness Act prohibits standard contract terms that restrict or penalize honest customer reviews. The FTC’s Rule on the Use of Consumer Reviews and Testimonials also prohibits creating or selling fake reviews and buying reviews a business knows, or should know, are fake. Incentives conditioned on a positive or negative review are prohibited.

Order fulfillment regulations

Under the FTC’s Mail, Internet, or Telephone Order Merchandise Rule, sellers need a reasonable basis for their advertised shipping time. If no time is stated, the usual deadline is 30 days.

If you cannot ship on time, notify the customer before the deadline and offer a revised shipping date or explain that the timing is uncertain. Give them the option to cancel for a full refund, and follow the rule’s consent requirements for any delay.

Endorsement and affiliate disclosure

The FTC’s Endorsement Guides call for clear disclosure of material relationships that audiences would otherwise miss. Ensure affiliates disclose commissions near their recommendations and links. Give partners disclosure instructions and check their posts for compliance.

All-in pricing

Under California’s Honest Pricing Law, advertised prices for covered consumer purchases generally must include mandatory fees. Government-imposed taxes and reasonable shipping costs for physical goods can be listed separately. Mandatory handling charges must be included in the advertised price.

Protecting your business: tax, licensing, and IP requirements

Selling across state or national borders can create new tax obligations. Review your registration requirements when you enter a new market or change where you store inventory.

Choose the right business structure

Your business structure affects your personal liability and how your business is taxed. US options include:

• Sole proprietorship. A sole proprietor is a person who operates a business unless they form another entity. The owner is personally responsible for business debts and legal claims.
• Limited liability company (LLC). An LLC protects your personal assets from business debts and lawsuits. For federal income tax purposes, a single-member LLC usually reports business activity on its owner’s return, while a multimember LLC is usually taxed as a partnership, with profits passing through to its owners. LLCs can elect C corporation or S corporation tax treatment.
• Corporation. A corporation is a separate legal entity owned by shareholders. It protects shareholders’ personal assets and can issue stock, but requires more formal recordkeeping.

Licensing requirements vary by country and location. In the United States, federal licenses apply to regulated activities, such as manufacturing alcohol. State, county, and city governments set additional requirements, including local business permits. Check the rules for your activities and premises, even when you operate from home.

Resellers generally need a seller’s permit or equivalent sales tax registration in each sales-tax state where they are engaged in business and required to collect tax.

When purchasing inventory tax-free for resale, provide your supplier with a valid resale certificate. Check each state’s registration rules and sales tax exemptions, including those for sellers trading exclusively through marketplaces.

Understand tax obligations

In the United States, sales tax nexus is a sufficient connection between your business and a state to create sales tax obligations. Economic nexus occurs when sales into the state meet its legal threshold. Every state sets its own thresholds and rules for which sales count.

Shopify’s tax liability insights flag potential US nexus based on your store locations and eligible sales data. Review them under Settings > Taxes and duties > United States. Account for sales and business activities outside the tool’s coverage, then confirm where to register and collect tax. Follow each tax authority’s filing and payment schedule.

Other tax obligations to plan for include:

• Estimated income tax
• Value-added tax (VAT)
• Import duties and delivered duty paid (DDP)
• US de minimis suspension

Estimated income tax

US individuals generally need estimated tax payments if they expect to owe at least $1,000 after withholding and credits. Corporations generally face a $500 threshold. The IRS divides the year into four payment periods. Check state requirements separately and revise your estimates as business income changes.

Value-added tax (VAT)

International sales can create VAT registration and collection obligations. The EU applies VAT to imported goods regardless of their value. Its Import One Stop Shop (IOSS) simplifies VAT reporting and payment for eligible imported shipments valued at €150 or less. Confirm the applicable VAT rate and who is responsible for collecting and paying it.

Import duties and delivered duty paid (DDP)

DDP shipping places responsibility for import clearance and applicable duties and taxes on the seller. Shopify can calculate and collect duties and import taxes at checkout for eligible stores. Add accurate Harmonized System (HS) codes and product origins, then arrange DDP fulfillment with a compatible carrier so collected charges are handled during import clearance.

US de minimis suspension

The United States has suspended duty-free de minimis treatment previously available for eligible imports valued at $800 or less. Check applicable duties and customs procedures for low-value orders entering the US, and factor those costs into pricing and shipping charges.

Obligations like these are often a reason for business owners to partner with a financial adviser.

Protect your brand with trademarks and patents

Trademarks and patents protect different types of intellectual property:

• Trademarks protect identifiers that distinguish your goods or services, such as your store name. Federal registration can help prevent others from using a confusingly similar mark for related products.
• Patents protect qualifying inventions, such as a new manufacturing process. A patent gives its owner the right to exclude others from certain activities involving the invention for a limited period.

Original product photographs generally fall under copyright protection. Identify what you want to protect before choosing a registration or application process.

Be aware of product restrictions

Check the destination country’s product and import rules before offering international shipping. Confirm that your carrier accepts the product and that your packaging meets its standards.

For example, USPS restricts perfume containing alcohol to domestic ground transportation and prohibits it in international mail. Check the specific shipping service before promising a customer delivery.

Consider business insurance

If you hire employees, check workers’ compensation requirements in each state where they work. Employers also have federal and state unemployment insurance obligations. Employers in certain states, including New York, must provide disability benefits coverage for covered employees.

For your store’s assets, commercial property insurance can cover inventory damaged by a covered event, such as a fire. Liability insurance can cover specified claims against your business, subject to the policy’s terms and limits. Ask an insurer to confirm coverage for the products you sell and the locations where you keep stock.

Get professional ecommerce legal advice

Before launching, confirm your business registration and licensing requirements. Review your store policies and data-handling practices, and establish where you need to register, collect, and pay taxes.

Consult a lawyer familiar with your target market before selling in another country or introducing a regulated product. If customer data is exposed or you receive a legal demand, get advice promptly about your response and any deadlines.

Shopify lets you manage store policies and customer privacy settings from your admin. Have your lawyer review these against your business practices and applicable laws.